We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B
Over channel A (mobile carrier) we collect the first 8 digits of the credit card followed by the cvv. Now we are not in control of logging over this channel and they might log this in clear text.
Over channel B, agent collects the rest of PAN and expiry date.
We then reconstruct it to switch.
My Question is this, point 3.2 of PCI compliancy states you are not allowed to store cvv, but does this apply with segmented PAN? My argument is that you cant do anything with CVV without the full pan.